Using mobile hotspot for WAN
-
@JKnott said in Using mobile hotspot for WAN:
They should still know how to reach your prefix
T-Mobile treats it as a single IP; so, anything behind pfSense won't get an IP...that was my disappointment and reason to return the box.
-
I'm interested in this as well. My Comcast cable goes down fairly frequently late at night for "scheduled maintenance" that they never notify about, despite my requests over many years. I'm tired of calling them to request bill credits each time. And that doesn't solve the problem of interrupted streaming. I need a cheap backup ISP for about 4-10 hours a month worth of Comcast downtime.
I have been testing Verizon 5G Home Internet since Saturday, because they upgraded their towers in my area, and offer the service at my address. The other carriers (AT&T, T-Mobile) will not sell it to me, for good reason - weak signal. I setup the Verizon ARC-XCI55AX gateway in IP passthrough mode. It is a perfectly adequate backup. The basic service, which I'm testing, costs $50/month, however. $600/year is a bit much to pay to cover the 4-10 hours worth of Comcast downtime that they shouldn't have in the first place.
It just so happens that my cellular provider, US Mobile, is an MVNO for both T-Mobile or Verizon. They offer a shared data plan, which would be perfect for our 2 smartphones, and a 3rd line for the home ISP backup. However, I need an unlocked 5G modem that will accept either an eSIM or a physical SIM. And it needs to preferably connect to pfSense via Ethernet. So far, I have not been able to locate such a device. Is there one ? One device was mentioned upthread, but it is only 4G LTE, not 5G, and the manufacturer does not have a 5G version.
The other possibility would be to use a smartphone for the backup WAN. I have not tried to enable USB tethering on my phone and connecting it to pfSense. Right now, the phone is still on the T-Mobile network, which provides speeds of 0.07 Mbps up and 0.04 Mbps down. Definitely not suitable as a backup WAN.
If USB tethering doesn't work, the other option would be to use the phone as Wifi hotspot, and add a Wifi NIC to pfSense for the WAN connection. It seems that this should work per https://docs.netgate.com/pfsense/en/latest/wireless/configuration-wan.html, although it does not mention how to input the Wifi password. Presumably this is part of the encryption settings.I would much prefer to use a 5G modem with an Ethernet connection if one exists, than use a smartphone, though. Phones are subject to getting updates and rebooting themselves at the most inopportune times, possibly requiring user interaction to restart, which is not always possible if I'm traveling and need to access the home VPN. Phones also depend on a battery with limited lifespan.
-
@NollipfSense FYI, Verizon 5G Home Internet is providing me with a public, routable IPv4 address over DHCP.
DHCP6 also works, but I haven't messed with it .AT&T and T-Mobile don't have a usable data signal in my area.
-
@madbrain said in Using mobile hotspot for WAN:
DHCP6 also works, but I haven't messed with it .
I think you'll find most, if not all, cell networks have moved entirely to IPv6. However, I haven't heard of any of them providing DHCPv6-PD to the clients. You can get IPv6 addresses to devices connected to the phone or router, but not beyond that.
Take a look at your phone's IPv4 address. If it's something like 192.0.0.2, your phone is using 464XLAT to provide access to IPv4 only sites over an IPv6 only network.
PfSense running on Qotom mini PC
i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
UniFi AC-Lite access pointI haven't lost my mind. It's around here...somewhere...
-
@JKnott I would take a look, but my phone, currently on a T-Mobile MVNO, isn't getting any data signal over cellular at the moment. Just 2 bars worth of signal. That's not usually the case. I have waited several minutes and don't see a change. Maybe the T-mobile cell towers lost power. From what I have read, T-mobile uses CG-NAT for their home internet service. Signal just came back, and the phone has a 192.x.y.z local IPv4 address.
The Verizon Home Internet 5G service, on the other hand, works fine even with IPv6 completely turned off on the router for the corresponding WAN interface. I have 3 ISPs connected to my pfSense box right now, and all of them are getting public IPv4 routable addresses. One of them doesn't support IPv6 at all.
Everything behaves even if IPv6 is disabled on all WAN and LAN links. I have tested VPN from the outside with all 3 WANs using dynamic DNS, but not at the same time, as I would need 3 separate VPN configurations and 3 dynamic DNS names. -
@JKnott I can confirm on my T-Mobile I am getting 192.0.0.2
Interesting thread. I know somebody with T-Mobile home Internet I wish I checked their IP now. With my T-Mobile hotspot I've had occasions where it will connect up and have signal but no data will pass from my travel router and I have suspected that this is due to the hotspot only getting an IPv6 address (can't remember if I've confirmed this I vaguely remember not seeing a IPV4 address listed in its status) and not having translation or the translation not working. Usually a reboot or 2 solves that although the hotspot doesn't give me high confidence either since it'll be 95°f out and it tells me it's shutting down due to "low temperature"?From what I understand most networks have switched to IPV6 internally which is what they should've done instead of carrier grade NAT in the first place. There's an entire address block for IPV4 within IPV6 it makes no sense to me why they're not just using that on the backend to route IPV4 into IPV6 and then back to IPV4.
-
@wgstarks
I am using one right now and everything (except IPv6, but this is due to my carrier) is working excellently.I recommend buying an unlocked hotspot, so you can be more flexible with swapping SIMs/carriers. This is what I use:
https://www.netgear.com/home/mobile-wifi/hotspots/mr6550/
This one is cheaper and you only lose 5G mmWave and potentially Wi-Fi 6E if you use the hotspot as a Wi-Fi router (I don't and you can't, if you you want to incorporate pfSense in the setup):
https://www.netgear.com/home/mobile-wifi/hotspots/mr6150/
Where I live I get up to 450 Mbps, usually around 200.
Both devices can connect to your pfSense box either through Ethernet or USB and offer passthrough mode.
I can also point you towards an unlimited (with some caveats) BYOD plan, if you are interested.
Hope that helps.
-
@madbrain " speeds of 0.07 Mbps up and 0.04 Mbps down"
That's either some really bad signal or maybe you're roaming? Was just up in upstate New York and whenever we hit an area outside of T-Mobile we roamed onto AT&T and they throttle the connection. My research sent me down to the info on AT&T emergency coverage just enough for calls and texts but it looks like they just agreed to leave it on all the time. Which is really annoying when you're trying to live stream something and the location you end up in is roaming but half a mile away isn't.
During this adventure I discovered that the data on the phone and the data to the hotspot with my Visible plan was different, I was using an iPhone. I was also reminded that the iPhone if it can connect to Wi-Fi like say a travel router won't forward data even though it's connected over USB tethering.... to the same travel router.Ouch $600 a month for 4 to 10 hours. Might be worth looking into Comcast Business (which guarantees me speed +10% or something like that ) but part of the package was a AT&T+Verizon cradle point back up gateway ( that's unfortunately completely locked down) instructions say to loop through it but then you have no control so I have it hanging off one of my extra WANs. approximately $250/m for 300mb and they text me when there's an outage. As much as I don't like normal Comcast.
If you do go to the Wi-Fi off the phone route. I have found rather than adding the complexity of Wi-Fi into PFsense (although supposedly it works just not with the cards I have). TP Link has a 20 something dollar travel router 2x2 cube that has a client mode and then just spits that out as ethernet fairlee transparently. I set it to a static IP 192.168.111.2 within the same NET IP of my hotspot 192.168.111.1 but this also works for cell phone hotspots. PFsense can be either dynamic or static doesn't matter I've done it both ways.
That's how I did it for years before getting Comcast only issue was AT&T policies, routing and billing and then we switch to Sprint>T-Mobile. -
@imark77 said in Using mobile hotspot for WAN:
From what I understand most networks have switched to IPV6 internally which is what they should've done instead of carrier grade NAT in the first place. There's an entire address block for IPV4 within IPV6 it makes no sense to me why they're not just using that on the backend to route IPV4 into IPV6 and then back to IPV4.
Originally, the cell networks didn't support IPv6 and CGNAT was the only way to provide IPv4. Some of those IPv6 blocks containing IPv4 addresses are using for conversion methods such as 464XLAT. Changing from IPv4 to IPv6 didn't happen all at once, but rather in stages.
-
@sarrasine said in Using mobile hotspot for WAN:
Both devices can connect to your pfSense box either through Ethernet or USB and offer passthrough mode.
Does that include DHCPv6-PD to pfSense?
-
Right now I can't confirm because it looks like T-Mobile does not provide prefix delegation, before T-Mobile I had AT&T and as far as I can recall, I was getting an IPv6 on all of my devices connected to the pFSense box.
Sorry I could not offer better explanation, I am trying to learn all of this new (to me) terminology and possibly sound dumb at times
. -
@sarrasine
Actually I went a different route. Found out that my local cable company will install cable to anywhere for about $8(US)/foot so paid them for about 4700 feet. Was really the only option. No cell towers within 2 miles. T-mobile was willing to sell me a plan anyway be the speeds were awful. Starlink is still not available in my area. -
@imark77 The 0.0.7 / 0.04 speeds are from really bad T-Mobile signal. It is not roaming. I live on a hill, and that's the speeds I get in my home office when the phone is on 4G LTE. Sometimes it switches to 5G, and the download speed goes way up, but the upload speed remains the same. This morning it wasn't getting any data signal at all for several minutes, just a few bars, presumably GSM only. Voice calls over cell tend to have frequent periods of >1s silence. This weak T-mobile signal was unfortunately the best cell signal I could get in this room, and in most rooms, between the major 3 carriers for the 14 years I have been here. 3 years ago I tried a Verizon 5G SIM with my phone. Speedtest got 0.001 Mbps down / 0.000 up. Ie. just 1kbps ... It was a free trial and I obviously cancelled.
Basically, only Wifi calling works for calls, or wired VoIP. I had Ooma before, and switched to voip.ms a few weeks ago using a Grandview HT802 analog telephone adapter. The Panasonic DECT 6.0 analog phone with the maximum 6 handsets covers my entire property inside and out, something that Wifi cannot do even with 6 APs, and that the cell carriers couldn't do either, but that may have changed recently with the new Verizon towers.As far as the price, not sure where you got $600/month. I clearly mentioned Verizon was charging $50/month, which is $600/year. I still think it's too much for a backup that's seldom used. I would prefer a less expensive plan without unlimited data. Maybe a plan with only 1GB of data included, and the ability to pay extra by the GB, as needed.
I am not sure how Comcast business is going to be any better than Comcast residential service (Xfinity) which I have at the moment. When Comcast does their so-called "scheduled maintenance", the cable modem loses sync. Unless they are running a separate cable on which they aren't doing this maintenance, I don't see how business will it help. It will certainly cost more, though, and I'm trying to minimize costs and ditch Comcast altogether due to both the outages and price increases.
I was paying $80/month for 1200 / 200 service. The speeds were more than good enough, as well as the price. But it went to $150 after the contract ended. I got a new contract, but the best they would do was $110, even though new customers pay $90 for the same service. For the first time in 20 years with Comcast, they just wouldn't match new customer price. The fact that speeds drop to 0 / 0 during all the outages is much more problematic though. I'm tired of having to go outside late at night to make a call and request a bill credit. I would like to trade some speed for more reliability, preferably without contract, which means without Comcast, and at lower cost than the $110 I'm paying right now.I believe a 5G smartphone could be used as a WAN with pfSense, either through USB tethering, Wifi hotspot, or even Ethernet tethering that I read about. All those should do the job, but they have one thing in common - they probably will only work for outbound connections due to the phone acting as a router, and performing NAT. That covers most of the use cases, which are principally outbound traffic late at night when streaming and getting a Comcast outage. I would like to also cover inbound traffic for remote access to my home, but this will require a public IP address from the carrier, either IPv4 or IPv6, and I'm not sure it's possible to get one with a SIM. Verizon 5G Home Internet does hand out public IPs, but requires the $50/month subscription. I need a device that will take a physical SIM to use a US Mobile Warp 5G shared data plan that uses the Verizon cell network. Fedex just delivered such a SIM a few minutes ago. I'm going to port my cell phone line from GSM 5G (T-Mobile) to Warp 5G (Verizon) while staying with the same MVNO, US Mobile. Hopefully, my signal issues on the phone will finally be history. And I will be able to see what kind of IPs the phone gets, once the port is done. It would great if one of the IPs was public.
-
@sarrasine Thanks. I don't need the mmWave here in the hills. It is not economically viable to deploy it in this area. I saw those Netgear devices. Both are pretty expensive, though, and are a bit overkill. I believe a cheap 5G smartphone such as a used, unlocked Samsung A14 could do the same job. I don't need very high speeds at this is just for backup. Verizon throttles the home internet service to about 110 Mbps down / 12 Mbps max and that still works fine as a backup.
I believe Wifi can be used as a WAN in pfSense, both with these Netgear devices and a smartphone. But it is not the preferred method. USB or Ethernet would be better.
A smartphone will only act as a router when tethering, though. Will the Netgear hotspots work in bridge mode, as opposed to router mode ?
I'm interested in a BYOD plan, but probably not an unlimited one due to price constraints. I still would like to know what the terms are, and in particular whether a public IP is offered or not.
-
@wgstarks There is AT&T fiber half a mile downhill. I do not have $8/ft to spare right now, though. And I do not think AT&T would take my money to run it, also :-(. My home is within the coverage area of all 3 cell operators, and has been for many years. But the maps are really fantasy, and none of the cell signals have been usable until recently, at least not indoors.
-
FYI, I spent many hours last night researching 5G modems/router devices. I found the following 3 :
https://www.neteon.net/idg450-0gt0c/
https://www.getic.com/product/teltonika-trb500-industrial-gateway?vat_state=excl¤cy=USD
https://www.waveshare.com/rm520n-gl-5g-router.htm?sku=25520These are less expensive than the Netgear devices mentioned upthread. I'm not sure if they all support the required bands for US 5G services, though. I would have to dig deeper into the specs. I believe all 3 can be put in bridge mode, and avoid double NAT, something I believe a 5G smartphone cannot do. The 5G provider still needs to provide a public IP address for bridge mode to help, though.
-
@madbrain
Hi,
The Netgear hotspots will work in IP Passthrough mode, I am not sure if this is the same as Bridge Mode though.
I am in a place where I can get Comcast (cable, used to have it), AT&T fiber, but I chose to go wireless (and complicated the hell out of my life, lol). I dropped the cable, because it is a lightning surge risk (a major no-no for me, nobody properly grounds these), I was going to get AT&T fiber, but they insist on me using their gateway, which I won't do - I never use carrier branded equipment. So until AT&T start allowing us to buy our own modems, I am out. The only option left was to go wireless, but then the carriers still insist on you using their crappy gateway. So I had to get a SIM by becoming a member of FMCA and getting one of their plans : )
But... The plan comes with a 100 GB of priority data and is deprioritised after that, although it is marketed as unlimited. $60 a month.
Additionally, it comes with a heavy video throttling
. So I have to run a VPN on my pfSense box in order to get rid of the video throttling. -
@sarrasine Yes, IP passthrough is the same as bridge mode. Comcast calls it bridge mode, and it is easy to find. Verizon calls it IP passthrough, and it is buried behind quite a few clicks in the web admin.
You are lucky to be able to get fiber, cable and wireless Internet. Until recently, I could only get cable.
I don't find the carrier gateway to be a serious issue, from a technical standpoint at least. As long as they are in bridge/IP passthrough mode, and the ISP provides public IPs, it all works great with pfSense. I have my Comcast XB8 in bridge mode, and Verizon ARC-XCI55AX gateway in IP passthrough mode. That means all router functionality is disabled, as well as Wifi. It would be better to have a strict modem without routing or Wifi, but economies of scale probably means such a device would sell less, and cost more.
Of course, the price of the device is built into the service cost. I prefer to have one time cost than a recurring one. Comcast will not offer unlimited data service if you use your own equipment, unfortunately. It's not every month that I use over 1.2TB of data, though.I also have a 3rd ISP in trial right now, Sail Internet. They installed a fixed wireless antenna on my roof. I was supposed to get 200 / 200 Mbps, but a palmtree grew in the line of sight. They had to install a new antenna pointed somewhere else. I get about 200 / 30 from it.
Sail uses a POE modem that's actually on the roof. It is a straight modem, not router. They asked me if I needed a router when I signed up, and I told them no, as I have my own pfSense box.I don't get why you are so concerned about lightning surges. If the cable is not properly grounded, can't you get the cable company to come over and ground it properly ? It should be their responsibility. Also, there are surge protectors for coaxial cable. I'm not sure how effective they are, but name brands usually provide some kind of insurance, which could cover some damage to your equipment.
All my equipment is plugged into surge protectors. I even installed many surge protecting outlets. I also have a heavy duty surge protector installed in my main electrical panel, and 2 in electrical subpanels as well.Right now, I have two coax cables coming into my office, once from Comcast and one from Sail. In my home theater, there used to be another 2 coax, one from my OTA for TV channels, and another from Dish. The Dish came down a few years ago during fumigation. I was able to keep the OTA, which I still use daily with a HD Homerun DVR and attached USB SSD.
We had some serious lightning strikes in 2020 around here, but no actual issues at my home, except that we were subject to a pending evacuation order that fortunately never came. The air quality was awful for a month following all these fires, though..
https://en.wikipedia.org/wiki/August_2020_California_lightning_wildfiresI would not choose wireless if wired was reliable, but unfortunately it isn't. 100GB is about 3% of my usual monthly consumption with Comcast. I have exceeded the 1.2TB cap a few times, but am paying for unlimited data.
Funny that your ISP only throttles video and not VPN traffic after you exceed your high-speed data.
-
@nimrod
I tried this not using a phone but a wireless access point called Pantech 4G from Verizon (I was charged $35.00 per month to have this device activated), which plugged into a usb port. It worked, however it was spotty like a cell signal can be and the biggest problem was if pfsense was restarted the configuration would be lost; something about the order of loading USB drivers in freeBSD caused a hickup. So are you able to reboot pfsense and not loose the configuration? As someone below stated they don't like using USB devices because of lack of support. -
I don't get why you are so concerned about lightning surges. If the cable is not properly grounded, can't you get the cable company to come over and ground it properly ? It should be their responsibility. Also, there are surge protectors for coaxial cable. I'm not sure how effective they are, but name brands usually provide some kind of insurance, which could cover some damage to your equipment.
Lighting surges are a major phobia for me. I have changed many high-end surge protectors (Panamax, Furman, ZeroSurge and finally top of the line SurgeX).
Coaxial can never be 100% protected and Comcast would definitely not do it properly. I live in an apartment and a few of my neighbors lost electronics due to surges on the coaxial line. Theirs were not expensive to buy again, but I have Mark Levinson gear that would be prohibitively expensive to replace. So, I have sworn off cable for good.
Fiber would be best, but as I said I hate the idea of using AT&T provided gateway, even if I could configure it with real IP passthrough, which I can't. Who knows what kind of deeply imbedded spyware they have (just my own two cents) in their boxes. It is a hard pass for me.
If you are still looking for wireless 5G modems/hotspots, make sure they have at least a Qualcomm X62 or better yet X65/67
modem, as that will ensure you have all the necessary bands.
Also, you might want to take a look at Peplink.
